---
typeId: req
recordId: benac-trust-003
fields:
  title: Authenticated and attributed trust decisions
  statement: >-
    A trust decision shall be attributable to a local user, Local Policy, delegated
    local authority, or authenticated agent acting under Local Policy.

    A trust decision shall bind the authenticated session or authority context used to
    create it where that context is available.

    A trust decision shall be enforceable only within its recorded scope.

    Invocation shall fail closed outside the package CID, interface identifier,
    descriptor scope, invocation contract snapshot, data class, capability, time, and
    revocation scope recorded in the trust decision.

    Effective authority for a package operation shall be the intersection of the
    package-declared requirements, trust-decision allowed scope, active capability
    grants, artifact availability, resource availability, and Local Policy.

    A trust decision shall not grant authority merely because a package is imported,
    signed, named, authored, known, or previously invoked.
  rationale: >-
    Trust decisions must be attributable and scoped so package authority can be reviewed,
    revoked, audited, and enforced.
  verification: >-
    Tests create trust decisions under authenticated and unauthenticated contexts.
    Invocation fails outside trust scope. Revoked, expired, or conflicted trust decisions
    fail closed.
  testable: true
  status: draft
  area: BENAC-TRUST
  sourceDocument: user-requested schema-first requirements cleanup
  sourceVersion: 2026-05-06
  sourceSections:
    - Trust, policy, and capability model
  order: 89.5
---
